A system and method for detecting and classifying network traffic anomalies is disclosed. The system includes an input module receiving a data stream containing information related to the network traffic, one or a plurality of the data stream analyzers and a correlation module. The correlation module receives results of the data stream analysis by the analyzers and determines if the potential anomaly is false or true.